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ABSTRACT 

A method and apparatus are provided for evaluating the security of authentication 
information that is extracted from a user. The disclosed authentication information security 
5 analysis techniques determine whether extracted authentication information can be obtained by 
an attacker. The extracted authentication information might be, for example, personal 
identification numbers (PINs), passwords and query based passwords (questions and answers). 
A disclosed authentication information security analysis process employs information extraction 
techniques to verify that the authentication information provided by a user is not easily obtained 
10 through an online search. The authentication information security analysis process measures the 
security of authentication information, such as query based passwords, provided by a user. 
Information extraction techniques are employed to find and report relations between the 
proposed password and certain user information that might make the proposed password 
vulnerable to attack. 
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